Wired broadbandWAN · Primary
Shaped with smart queues.
← all projects
project deep-dive
Home Network Architecture
One rack, two worlds: a locked-down, isolated segment and a self-built smart home, sharing physical infrastructure but never trusting each other. Built on UniFi, hardened in numbered phases, and documented for its own rollback.
// Specifics intentionally generalized. This describes an architecture, not a map.
UniFi Core StackL3-isolated SegmentsZone-based firewall ZonesMatter · Thread · Zigbee Smart Home
01 · Trust boundaries
Segmentation
The whole design turns on one rule: work traffic and home traffic share cabling and a rack, but live on separate Layer-3 segments that cannot route to each other. A zone-based firewall enforces isolation by default; every cross-zone path is an explicit, named exception.
Edge & gateway
Cellular failoverWAN · Backup
Sub-10s failover, tuned SLA probes.
UniFi Cloud GatewayGateway · Router · Controller
Inter-segment routing plus policy enforcement — the single point where segments meet and get filtered.
Zones
Trusted HomeTrusted
Laptops, phones, Apple Home hubs, local compute.
IoTDefault-deny
Cameras, sensors, hubs. Default-deny to Trusted.
ManagementInfra only
Infrastructure only. No lateral reach inward.
GuestIsolated
Internet-only. Client isolation plus zone firewall.
WorkIsolated
Enterprise-firewall-managed. Reaches nothing on home.
Clean ownership boundary: the second segment enters through its own upstream firewall, and its traffic is NAT'd across a transit link into a DMZ zone that is blocked from every home zone by default — isolation without special-casing.
02 · Hardening
What's been hardened
Work proceeds in numbered phases, audited layer by layer — internet edge, then networks, then security, then WiFi, then system hygiene. A few of the load-bearing decisions:
VLAN split with a dedicated management planeA
The flat default network was split out; infrastructure moved onto its own management VLAN that non-trusted zones can't reach — so a compromised device can't pivot into the gear that runs the network.
Default-deny between home and IoTB
Smart-home devices can't initiate to trusted machines. Only a short allow-list of personal Apple devices can reach into IoT, plus the specific hub coordination Matter needs. Everything else is closed.
Encrypted DNS + IPS with curated geo-blockingC
Client DNS runs through an encrypted resolver. An intrusion-prevention engine watches the trusted, IoT, and guest segments — management and transit deliberately excluded — with bidirectional region blocking and a honeypot address that flags any device probing it.
WPA3 primary WiFi with a MAC allow-listD
The main SSID is WPA3-only with protected management frames and an allow-list, so a leaked passphrase from a former houseguest still won't get an unknown device onto the trusted network. IoT and guest run separate SSIDs tuned for compatibility and containment.
Selective per-device VPN routingE
A specific set of personal devices egresses through an outbound VPN tunnel; everything else takes the normal path. Routing is per-device, not all-or-nothing.
Documented for rollbackF
Every phase records pre-change state, foot-guns, and recovery checklists. Config changes are deliberate and reversible — the network can be rebuilt from its own notes.
03 · Home automation
Smart home, three ways in
The home automation layer sits entirely inside the IoT and trusted zones, coordinated by Apple Home. Devices reach it through whichever path fits their protocol — chosen for fewest hops and fewest firmware surprises.
-
path 01
Direct Matter
Matter-native devices commission straight to Apple Home over the local fabric. Cleanest route, least dependent on vendor bridges.
-
path 02
Zigbee via a bridging hub
Legacy Zigbee-only devices attach to a PoE hub that acts as a Thread border router and exposes them to Apple Home. IPv6 runs internally to satisfy Matter — WAN IPv6 stays off.
-
path 03
Bridge for richer control
Devices whose Matter profile only exposes on/off get a software bridge instead, surfacing full color, effects, and scenes to the home controller.
04 · Specs
At a glance
The shape of it, without the parts that would only help someone trying to get in.
| Field | Value |
|---|---|
| WAN | Wired + cellular failover |
| Mode | Failover, no load-balance |
| Shaping | Smart queues on |
| DNS | Encrypted, upstream-filtered |
| Field | Value |
|---|---|
| Trusted | Personal devices |
| IoT | Default-deny inward |
| Management | Locked to admin path |
| Guest / Work | Fully isolated |
| Field | Value |
|---|---|
| Primary | WPA3 + PMF + allow-list |
| APs | Wi-Fi 7, wired backhaul |
| Channels | Manually pinned |
| Guest | Rate-limited, scheduled |
| Field | Value |
|---|---|
| Updates | Windowed, deliberate |
| Auth | Passkey + MFA + codes |
| Backups | Cloud + local, weekly |
| Remote admin | Off unless in use |
05 · War stories
Bugs worth the scar tissue
The interesting part of running your own infrastructure is what breaks in ways the docs don't cover. A few that took real diagnosis:
A phantom switch that didn't existRoot cause · vendor interaction
Wired clients flapped connect/disconnect every couple of minutes for weeks. An upstream device was emitting discovery frames stamped with its chassis MAC rather than the egress port's, so the controller saw the 'same device on two ports' and churned its topology endlessly. Fix: disable that discovery transmission at the right levels and let the cached state expire. Took careful elimination to pin down.
Every smart device refused to pair — because of a phone settingRoot cause · protocol interaction
New Matter devices failed to commission across every method, all failing instantly before touching the network. The culprit: an enabled Personal Hotspot reconfigured the phone's Bluetooth/WiFi stack and broke the BLE handshake commissioning depends on. Disable it, reboot, and everything paired.
A cloud integration that 'worked in the app' but nowhere elseRoot cause · silent credential expiry
A lighting integration silently dropped one device. The vendor app kept running on a cached session token while the underlying password auth had been invalidated server-side — so every other client broke quietly. Reset, re-auth, and a more resilient API key as backup.
06 · Roadmap
What's next
Ongoing, multi-phase build. The network keeps growing tighter, one deliberate change at a time.
- Tighter management-plane access
- Gradual IoT migration
- A self-hosted automation platform